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JOSEPH H. HUNT 
Assistant Attorney General 
Civil Division 
GUSTAV W. EYLER 
Acting Director 
KENDRACK D. LEWIS 
Trial Attorney 

Consumer Protection Branch 
U.S. Department of Justice, 
Civil Division 
P.O. Box 386 

Washington, DC 20044-0386 
Telephone: (202) 353-3881 
Fax:(202)514-8742 
kendrack. lewis @ usdoj .gov 

MONIQUE F. EINHORN 
RYAN M. MEHM 
Attorneys 

Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 
Telephone: (202) 326-2575 
meinhom @ ftc. gov 
rmehm@ftc.gov 

Attorneys for Plaintiff 


UNITED STATES DISTRICT COURT 
NORTHERN DISTRICT OF CALIFORNIA 

SAN JOSE DIVISION 


UNITED STATES OF AMERICA, 
Plaintiff, 
vs. 

UNIXIZ, Inc., a corporation doing business 
as i-Dressup.com, and 

ZHIJUN LIU and XICHEN ZHANG, 
individually and as officers of UNIXIZ, 
Inc., 

Defendants. 


Case No. 5:19-cv-2222 


COMPLAINT FOR CIVIL PENALTIES, 
PERMANENT INJUNCTION, AND 
OTHER EQUITABLE RELIEF 
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Plaintiff, the United States of America, acting upon notification and on behalf of the 
Federal Trade Commission (“FTC” or “Commission”), for its Complaint alleges that: 

1. Plaintiff brings this action under Sections 5(a)(1), 5(m)(l)(A), 13(b), and 16(a) of 
the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a)(1), 45(m)(l)(A), 53(b), and 
56(a), and Sections 1303(c) and 1306(d) of the Children’s Online Privacy Protection Act of 1998 
(“COPPA”), 15 U.S.C. §§ 6502(c) and 6505(d), to obtain monetary civil penalties, a permanent 
injunction, and other equitable relief for Defendants’ violations of Section 5 of the FTC Act, 15 
U.S.C. § 45, and the Children’s Online Privacy Protection Rule (“Rule” or “COPPA Rule”), 16 
C.F.R. Part 312. 

JURISDICTION AND VENUE 

2. This Court has subject matter jurisdiction over this matter under 28 U.S.C. §§ 
1331, 1337(a), 1345, and 1355, and under 15 U.S.C. §§ 45(m)(l)(A), 53(b), and 56(a). 

3. Venue is proper in the Northern District of California under 15 U.S.C. § 53(b) and 
28 U.S.C. §§ 1391(b) - (d) and 1395(a). 

INTRADISTRICT ASSIGNMENT 

4. The conduct at issue in this action took place in substantial part in Santa Clara 
County. 

SECTION FIVE OF THE FTC ACT 

5. Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits unfair and deceptive 
acts or practices in or affecting commerce. 

THE CHILDREN’S ONLINE PRIVACY PROTECTION ACT RULE 

6. Congress enacted COPPA in 1998 to protect the safety and privacy of children 
online by prohibiting the unauthorized or unnecessary collection of children’s personal 
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information online by operators of Internet Web sites and online services. COPPA directed the 
Commission to promulgate a rule implementing COPPA. The Commission promulgated the 
COPPA Rule on November 3, 1999, under Section 1303(b) of COPPA, 15 U.S.C. § 6502(b), and 
Section 553 of the Administrative Procedure Act, 5 U.S.C. § 553. The Rule went into effect on 
April 21, 2000. The Commission promulgated revisions to the Rule that went into effect on July 
1, 2013. Pursuant to Section 1303(c) of COPPA, 15 U.S.C. § 6502(c), and Section 18(d)(3) of 
the FTC Act, 15 U.S.C. § 57a(d)(3), a violation of the Rule constitutes an unfair or deceptive act 
or practice in or affecting commerce, in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 
45(a). 

DEFENDANTS 

7. Defendant Unixiz, Inc., which also does business as i-Dressup.com (“i-Dressup”), 
is a California corporation established on June 27, 2016, with its principal place of business in 
Mountain View, California. Unixiz, Inc. transacts or has transacted business in this district and 
throughout the United States. At all times material to this Complaint, acting alone or in concert 
with others, Unixiz, Inc. has advertised, marketed, and distributed its online content and website 
activities to consumers throughout the United States. Prior to the establishment of Unixiz, Inc., 
Defendant Liu and Defendant Zhang owned and operated i-Dressup as an unincorporated 
business from January 2016 to June 2016. From 2008 to 2015, Intellineur, Inc., a predecessor 
California corporation formed by Defendant Zhang, operated i-Dressup.com. Defendant Zhang 
was the Chief Executive Officer of Intellineur, Inc. and Defendant Zhijun Liu was Intellineur’s 
Registered Agent. Intellineur, Inc. was dissolved in December 2015. 

8. Defendant Zhijun Liu is the Chief Executive Officer and the Chief Financial 
Officer of Unixiz, Inc. At all times material to this Complaint, acting alone or in concert with 
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others, he has formulated, directed, controlled, had the authority to control, or participated in the 
acts or practices of Unixiz, Inc. d/b/a i-Dressup.com, including the acts or practices set forth in 
this Complaint. Defendant Liu, in connection with the matters alleged herein, transacts or has 
transacted business in this district and throughout the United States. 

9. Defendant Xichen Zhang is the Secretary of Unixiz, Inc. At all times material to 
this Complaint, acting alone or in concert with others, she has formulated, directed, controlled, 
had the authority to control, or participated in the acts or practices of Unixiz, Inc. d/b/a 
i-Dressup.com, including the acts or practices set forth in this Complaint. Defendant Zhang, in 
connection with the matters alleged herein, transacts or has transacted business in this district 
and throughout the United States. 

COMMERCE 

10. At all times material to this Complaint, Defendants have maintained a substantial 
course of trade in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 
15 U.S.C. § 44. 

DEFENDANTS’ BUSINESS PRACTICES 

11. Defendants operated i-Dressup.com, a website where users including children 
played dress up games, designed clothes, and decorateed their space. In addition, by 
participating in i-Dressup’s online community, users would make friends and blog. i-Dressup’s 
online community encouraged users to “explore their creativity and fashion sense with unique 
personal profiles.” 

12. i-Dressup allowed users to register as members. When a user first registered as a 
member, i-Dressup required the user to submit a user name, password, birthdate, and email 
address. If a prospective member indicated that he/she was over 13, the member had access to 
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all of the features of the website, including the ability to participate in i-Dressup’s social 
features, such as writing about themselves and their interests on an “About Me” page, creating 
blog posts, adding friends, and sending direct online messages. 

13. If a prospective member submitted a birthdate that indicated that he/she was undei 
13, the heading for the email field on a registration screen changed in real-time to “Parent’s 
Email.” Once the under-13 user entered a user name, password, birthdate, and email address and 
he/she clicked the “Join Now” button, i-Dressup collected the registration information entered 
and sent an email notice to the email address entered in the “Parent’s Email” field. 

14. The email notice described the i-Dressup website, along with the social features 
that were available only if the parent provided consent. 

15. The email notice contained a hyperlink through which i-Dressup sought consent 
from a parent to activate i-Dressup’s social features. If the recipient of the parental email notice 
clicked on the hyperlink in the email, he/she was taken to an online screen that contained the 
child’s user name and a pre-populated activation code. The individual receiving the parental 
email could consent by clicking the “Activate Now!” button on this screen. 

16. If a parent did not provide consent, Defendants provided these under-13 users 
with “Safe Mode” membership which allowed them to login to access all of i-Dressup’s doll- 
related games and features, but not its social features. Defendants collected the Safe Mode 
members’ registration information, such as their user name, password, and birthdate, and allowed 
child members to provide Defendants, through the account settings webpage, their first and last 
name and gender. Under-13 users could remain Safe Mode members indefinitely, and 
Defendants retained the child’s personal information as well as the parent’s email address, even 
if the child’s parent did not provide consent. 
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17. As of January 1, 2016, i-Dressup had at least 2.1 million users, of which 
approximately 245,000 entered an under 13 birthdate. 

DEFENDANTS ARE SUBJECT TO THE CQPPA RULE 

18. For purposes of Paragraphs 6 through 35, herein, the terms “child,” “collects,” 
“collection,” “disclosure,” “Internet,” “online contact information,” “operator,” “parent,” 
“personal information,” “obtaining verifiable consent,” and “Web site or online service directed 
to children,” are defined as those terms are defined in Section 312.2 of the COPPA Rule, 16 
C.F.R. § 312.2. 

19. The COPPA Rule applies to any operator of a commercial Web site or online 
service directed to children that collects, uses, and/or discloses personal information from 
children, or on whose behalf such information is collected or maintained, and to any operator of 
a commercial Web site or online service that has actual knowledge that it collects, uses, and/or 
discloses personal information from children. Defendants operated i-Dressup.com, which was a 
Web site directed to children. i-Dressup stated that ”[m]ost of our members are girls and boys 
between 7 and 17.” Because Defendants collected personal information from users who 
indicated that they are under thirteen years of age when they registered with i-Dressup, 
Defendants also have actual knowledge that they collected personal information from children 
through i-Dressup. 

20. The COPPA Rule defines “personal information” to include, among other things, 
a first and last name; a home or other physical address including street name and name of a city 
or town; online contact information (i.e., an email address or other substantially similar identifier 
that permits direct contact with a person online, such as an instant messaging user identifiers, 
screen name, or user name); a persistent identifier that can be used to recognize a user over time 
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and across different Web sites or online services; a photograph, video, or audio file where such 
file contains a child’s image or voice; or information concerning the child or parents of that child 
that the operator collects online from the child and combines with an identifier described in this 
definition. Through i-Dressup.com, Defendants collected personal information as defined in the 
Rule in the form of first and last name, an email address, and the child’s user name that the child 
can use to communicate with other users. They also collected other information that they 
combined with this information, such as passwords. Finally, they “collected” personal 
information under the Rule by enabling children to make personal information publicly available 
via i-Dressup’s social features. 

21. Because Defendants collected and maintained personal information from their 
users through i-Dressup, Defendants are operators as defined by the COPPA Rule, 16 C.F.R. § 
312.2. 

22. Among other things, the Rule requires that an operator of a child-directed Web 
site or online service meet specific requirements prior to collecting online, using, or disclosing 
personal information from children, including but not limited to: 

a. posting a privacy policy on its Web site or online service providing clear, 
understandable, and complete notice of its information practices, including what 
information it collects from children, how it uses such information, and its 
disclosure practices for such information, and other specific disclosures set forth 
in the Rule such as the operator’s contact information; 

b. providing clear, understandable, and complete notice of its information practices, 
directly to parents including specific disclosures about the operator’s obligation to 
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delete parental online contact information if consent is not obtained and a 
hyperlink to the privacy policy; 

c. obtaining verifiable parental consent prior to collecting, using, and/or disclosing 
personal information from children; 

d. deleting the parental online contact information if no consent was obtained; and 

e. establishing and maintaining reasonable procedures to protect the confidentiality, 
security, and integrity of personal information collected from children. 

DEFENDANTS’ COPPA VIOLATIONS 

23. Defendants’ privacy policy failed to include information that the COPPA Rule 
requires operators of child-directed Web sites to disclose, such as the operator’s name, address, 
telephone number and email address. 

24. Defendants’ direct notice failed to include the content that the COPPA Rule 
requires. Among other things, Defendants’ direct notice failed to include a hyperlink to 
i-Dressup’s privacy policy and failed to inform the recipient that if he/she did not provide 
consent within a reasonable time, from the date that the direct notice was sent, Defendants 
would delete the parent’s online contact information from i-Dressup’s records. In fact, contrary 
to COPPA’s requirements, Defendants did not delete the parent’s online contact information, 
but kept it indefinitely. 

25. Defendants failed to obtain verifiable parental consent. For Safe Mode members, 
Defendants failed to obtain any parental consent, even though such members were covered by 
COPPA. For other members, the purported parental consent method was inadequate because it 
was not reasonably calculated to ensure that the person providing consent was the child’s 
parent, as required by the COPPA Rule. 
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26. Defendants engaged in a number of practices that, taken together, failed to 
provide reasonable and appropriate data security to protect the personal information collected 
from consumers, including children through i-Dressup.com. Among other things, Defendants: 

a. failed to adequately assess the vulnerability of its web applications and network to 
commonly known or reasonably foreseeable attacks, such as “Structured Query 
Language” (“SQL”) injection attacks; 

b. stored and transmitted users’ personal information as well as other information 
submitted by users, including account passwords, in clear text; 

c. failed to implement an intrusion detection and prevention system, or similar 
safeguards, to alert Defendants of potentially unauthorized access to their 
computer network; and 

d. failed to monitor logs to identify potential security incidents. 

27. In late September 2016, Defendants learned that a hacker had accessed their 
computer network, and accessed the personal information of consumers, including children who 
used i-Dressup. In August, the hacker remotely accessed Defendants’ network, where 
Defendants stored in clear text, among other things, users’ user name, password, email address, 
full name, gender, and date of birth. The hacker accessed information of approximately 
2,125,000 users, including 245,000 users who indicated they were under the age of 13. 

28. The hacker gained access to Defendants’ computer network by exploiting 
commonly known and reasonably foreseeable vulnerabilities. 

29. Defendants were unaware that the personal information of any consumers had 
been accessed from their computer network until the hacker sent the hacked data to journalists. 
One of the journalists, in turn, attempted to contact Defendants, but, after having received no 
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response from Defendants for five days, subsequently contacted Defendant’s web hosting 
provider, who notified i-Dressup. 

30. Defendants could have addressed the failures described in Paragraph 26 by 
implementing readily available and relatively low-cost security measures. 

COUNT I (COPPA) 

31. Defendants collected personal information from children under the age of 13 
through the i-Dressup Web site, which Defendants operated and was directed to children. 
Moreover, because Defendants collected children’s birthdate and year, Defendants had actual 
knowledge that children used this online site. 

32. In numerous instances, in connection with the acts and practices described above, 
Defendants collected, used, and/or disclosed personal information from children in violation of 
the Rule, including by: 

a. Failing to provide sufficient notice on its Web site or online services of the 
information it collects, or is collected on their behalf, online from children, how it 
uses such information, its disclosure practices, and all other required content, in 
violation of Section 312.4(d) of the Rule, 16 C.F.R. § 312.4(d); 

b. Failing to provide sufficient direct notice to parents of the information Defendants 
collect, or in formation that has been collected on Defendants’ behalf, online from 
children, how it uses such information, its disclosure practices, and all other 
required content, in violation of Section 312.4(b) and (c) of the Rule, 16 C.F.R. § 
312.4(b)-(c); 

c. Failing to obtain verifiable parental consent in violation of Section 312.5 of the 
Rule, 16 C.F.R. § 312.5; 
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d. Failing to delete online contact information of the parent after having failed to 
obtain consent, in violation of Section 312.5(c)(1) of the Rule, 16 C.F.R. § 
312.5(c)(1); and 

e. Failing to establish and maintain reasonable procedures to protect the 
confidentiality, security, and integrity of personal information collected from 
children, in violation of Section 312.8 of the Rule, 16 C.F.R. § 312.8. 

Therefore, Defendants have violated the Rule, 16 C.F.R. Part 312. 

33. Pursuant to Section 1303(c) of COPPA, 15 U.S.C. § 6502(c), and Section 
18(d)(3) of the FTC Act, 15 U.S.C. § 57a(d)(3), a violation of the Rule constitutes an unfair or 
deceptive act or practice in or affecting commerce, in violation of Section 5(a) of the FTC Act, 

15 U.S.C. § 45(a). 

THIS COURT’S POWER TO GRANT RELIEF 

34. Defendants violated the Rule as described above with the knowledge required by 
Section 5(m)(l)(A) of the FTC Act, 15 U.S.C. § 45(m)(l)(A). 

35. Each collection, use, or disclosure of a child’s personal information in which 
Defendants violated the Rule in one or more ways described above constitutes a separate 
violation for which Plaintiff seeks monetary civil penalties. 

36. Section 5(m)(l)(A) of the FTC Act, 15 U.S.C. § 45(m)(l)(A), as modified by 
Section 4 of the Federal Civil Penalties Inflation Adjustment Act of 1990, 28 U.S.C. §2461, 
amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, 
Public Law 114-74, sec. 701, 129 Stat. 599 (2015), and Section 1.98(d) of the FTC’s Rules of 
Practice, 16 C.F.R. § 1.98(d), authorizes this Court to award monetary civil penalties of not more 
than $41,484 for each such violation of the Rule assessed after January 22, 2018. 
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37. Section 13(b) of the FTC Act, U.S.C. § 53(b), empowers this Court to grant 
injunctive and such other relief as the Court may deem appropriate to halt and redress violations 
of any provision of law enforced by the FTC. 

PRAYER FOR RELIEF 

Wherefore, Plaintiff United States of America, pursuant to Sections 5(a)(1), 5(m)(l)(A), 
13(b), and 16(a) of the FTC Act, 15 U.S.C. §§ 45(a)(1), 45(m)(l)(A), 53(b), and 56(a) and the 
Court’s own equitable powers, requests that the Court: 

A. Enter a permanent injunction to prevent future violations of the FTC Act and the 
Rule by Defendants; 

B. Award Plaintiff monetary civil penalties from Defendants for each violation of the 
Rule alleged in this Complaint; and 

C. Award other and additional relief the Court may determine to be just and proper. 

DATED this 24th day of April, 2019. 
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FOR THE FEDERAL TRADE 
COMMISSION: 

MANEESHA MITHAL 
Associate Director 
Division of Privacy and Identity 
Protection 

ROBERT SCHOSHINSKI 

Assistant Director 

Division of Privacy and Identity 

Protection 

MONIQUE F. EINHORN 
Attorney 

Division of Privacy and Identity 
Protection 

Federal Trade Commission 
600 Pennsylvania Avenue, N.W. 
Washington, DC 20580 
Tel: (202) 326-2575 
Fax: (202) 326-3062 

RYAN M. MEHM 
Attorney 

Division of Privacy and Identity 
Protection 

Federal Trade Commission 
600 Pennsylvania Avenue, N.W. 
Washington, DC 20580 
Tel: (202) 326-2918 
Fax: (202) 326-3062 


FOR PLAINTIFF 

THE UNITED STATES OF AMERICA: 

JOSEPH H. HUNT 
Assistant Attorney General 
Civil Division 

GUSTAV W. EYLER 
Acting Director 

/S/ _ 

KENDRACK D. LEWIS 
Trial Attorney 

Consumer Protection Branch 

U.S. Department of Justice, Civil Division 

P.O. Box 386 

Washington, DC 20044-0386 
Tel: (202) 353-3881 
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385 Property Damage Product 
Liability 

SOCIAL SECURITY 

861 HIA (1395ff) 

862 Black Lung (923) 

863 DIWC/DIWW (405(g)) 

864 SSID Title XVI 

Malpractice 

IMMIGRATION 


462 Naturalization 

Application 

465 Other Immigration 

CIVIL RIGHTS 

PRISONER PETITIONS 

865 RSI (405(g)) 

440 Other Civil Rights 

HABEAS CORPUS 

FEDERAL TAX SUITS 

441 Voting 

463 Alien Detainee 

Actions 

870 Taxes (U.S. Plaintiff or 

442 Employment 

510 Motions to Vacate 


Defendant) 

443 Housing/ 

Sentence 


871 IRS—Third Party'26 USC 

Accommodations 

445 Amer. w/Disabililies- 
Employment 

446 Amer. w/Disabilities-Other 

448 Education 

530 General 

535 Death Penalty 

OTHER 

540 Mandamus & Other 

550 Civil Rights 

555 Prison Condition 

560 Civil Detainee- 
Conditions of 
Confinement 


§7609 


375 False Claims Act 

376 Qui Tam {31 USC 
§ 3729(a)) 

400 State Reapportionment 
410 Antitrust 
430 Banks and Banking 
450 Commerce 
460 Deportation 
470 Racketeer Influenced & 
Corrupt Organizations 
480 Consumer Credit 
490 Cable/Sat TV 
850 Securities/Commodities/ 
Exchange 

890 Other Statutory Actions 

891 Agricultural Acts 

893 Environmental Matters 

895 Freedom of Information 
Act 

896 Arbitration 

899 Administrative Procedure 
Act/Review or Appeal of 
Agency Decision 
950 Constitutionality of State 
Statutes 


V. ORIGIN (Place c 

X 1 Original 
Proceeding 


“ X ” in One Box Only) 
Removed from 
State Court 


Remanded from 
Appellate Court 


Reinstated or 
Reopened 


Transferred from 
Another District (specify) 


Multidistrict 

Litigation-Transfer 


8 Multidistrict 

Litigation-Direct File 


VI. 


CAUSE OF 
ACTION 


Cite the U.S. Civil Statute under which you are filing (Do not cite jurisdictional statutes unless diversity 

The Federal Trade Commission Act: 15 U.S.C §§ 45(a)(1), 45(m)(l){A), 53(b) and 56(a), and 15 U.S.C §§ 6502(c) and 6505(d) of the Children's Online Privacy Protection Act 
Brief descrintion of cause: 

Violation of the Children's Online Privacy Protection Act 


VII. REQUESTED IN CHECK IF THIS IS A CLASS ACTION 
COMPLAINT: UNDER RULE 23, Fed. R. Civ. P. 

DEMANDS 35,000.00 

CHECK YES only if demanded in complaint: 

JURY DEMAND: Yes X No 

VIII. RELATED CASE(S), j UDGF 

IF ANV (See instructions): 


DOCKET NUMBER 


IX. DIVISIONAL ASSIGNMENT (Civil Local Rule 3-2) 

(Place an “X” in One Box Only) SAN FRANCISCO/OAKLAND 

X SAN JOSE 

EUREKA-MCKINLEYVILLE 


DATE j / 2J) / 20i9 SIGNATURE OF ATTORNEY OF RECORD 





































